Handling Scope for AD as an IdP to linux shibboleth SPs

[Allan West]

I have never had very good luck searching on this topic, and it's coming up more frequently so I'm looking for a sanity check (or a URL I've been missing).

I manage several hundred linux / apache website SPs, and several of the remote IdPs we authenticate to are Microsoft Active Directory servers. If we give the raw AD IdP metadata to the SPs, then the SP won't authenticate users because the IdP fails to assert a Scope. We have one (1) partner who provides scoped metadata for their IdP and everyone else requires us to maintain a scoped copy of their metadata for them.

My most recent search on the topic found a StackOverflow article:
https://stackoverflow.com/questions/37320303/shibboleth-sp-and-adfs-as-idp

which referred me to a Microsoft page:
https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/gg317734(v=ws.10)?redirectedfrom=MSDN

The MS page says that AD cannot add a scope to it's own IdP metadata and describes alternate ways to make your own. I've been doing it by hand in a text editor, and then leaving it to sit until the IdP owners reach out to say there's an update that we need to acknowledge.

Can someone please tell me whether there are:

  1.
automated tools for inserting a scope into AD IdP metadata?
  2.
bypass options for the SP to ignore the AD IdPs' scope check?
  3.
shibboleth SP docs that give more details about working with AD IdPs?

I'm just checking before another land grant university asks mine to do all the work for them to make their lives easier.
If I'm doing all I can, that's fine. I just hate that I've never found a clever way to make AD IdPs work better with linux SPs.

Thanks very much,
Allan West
allan at ufl.edu


NOTE: I'm totally happy if someone(s) point me to the Shibboleth documentation page I've been missing. I tend to find answers right after I give up and ask a larger audience.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250128/b23c204e/attachment.htm>